CyberRota Analysis
AI-GeneratedThe vulnerability affects the MegaMenu layout in the Helix Ultimate Joomla extension, where unsanitized configuration values can lead to stored Cross-Site Scripting (XSS) attacks. This allows attackers to inject malicious HTML or JavaScript, potentially compromising user data and site integrity. Joomla administrators and developers using versions prior to 2.2.10 should prioritize applying the latest updates to mitigate this risk.
Original NVD Description
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complete contextual escaping, allowing injection of malicious HTML/JS. Stricter sanitization and tag allowlists via `InputFilter` and `htmlspecialchars` were implemented.